- _confine_to_base now uses dedicated base dirs (input/user/output) instead of ComfyUI root
- _strip_legacy_prefix keeps old input/... user/... output/... values working
- add tooltips to the three path widgets
- update defaults and README path-constraint section (v2.1.2)
- verified with test_path_confine.py (21/21) and test_smoke_narrowed.py
Reflects the security and localization changes from 98a61ad.
- folder_path / log_folder / output_folder must now reside inside the
ComfyUI root: drop the "absolute path allowed anywhere" wording and
replace the out-of-tree example (C:/prompts/SFW) with an in-root path.
- Node display name is now "Batch Prompt Loader": remove the outdated note
claiming a Chinese display name, and fix the canvas search hint.
- Add a path-constraint notice under Installation explaining that escaped
or out-of-root paths are rejected.
Addresses maintainer review feedback on Comfy-Org/ComfyUI-Manager#3183.
Path traversal:
- Add _confine_to_base(), which resolves the real path (following symlinks)
and verifies it stays inside the ComfyUI root directory. Applied to
folder_path, log_folder and output_folder.
- Previously an absolute path was trusted verbatim and relative paths could
escape via '..', allowing a graph to read arbitrary files and to write or
delete .json files anywhere the server could reach.
- Log clearing now only removes JSON files previously written by this node
(validated by the 'prompt_file' key) instead of every .json in the folder.
UI localization:
- Node display name and all widget labels are now English.
